{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/incorporating-gradients-to-rules-towards","title":"Incorporating Gradients to Rules: Towards Lightweight, Adaptive Provenance-based Intrusion Detection","arxiv_id":"2404.14720","date":"2024-04-23","proceeding":null,"authors":["Lingzhi Wang","Xiangmin Shen","Weijian Li","Zhenyuan Li","R. Sekar","Han Liu","Yan Chen"],"abstract":"As cyber attacks grow increasingly sophisticated and stealthy, it becomes more imperative and challenging to detect intrusion from normal behaviors. Through fine-grained causality analysis, provenance-based intrusion detection systems (PIDS) demonstrated a promising capacity to distinguish benign and malicious behaviors, attracting widespread attention from both industry and academia. Among diverse approaches, rule-based PIDS stands out due to its lightweight overhead, real-time capabilities, and explainability. However, existing rule-based systems suffer low detection accuracy, especially the high false alarms, due to the lack of fine-grained rules and environment-specific configurations. In this paper, we propose CAPTAIN, a rule-based PIDS capable of automatically adapting to diverse environments. Specifically, we propose three adaptive parameters to adjust the detection configuration with respect to nodes, edges, and alarm generation thresholds. We build a differentiable tag propagation framework and utilize the gradient descent algorithm to optimize these adaptive parameters based on the training data. We evaluate our system using data from DARPA Engagements and simulated environments. The evaluation results demonstrate that CAPTAIN enhances rule-based PIDS with learning capabilities, resulting in improved detection accuracy, reduced detection latency, lower runtime overhead, and more interpretable detection procedures and results compared to the state-of-the-art (SOTA) PIDS.","url_abs":"https://arxiv.org/abs/2404.14720v2","url_pdf":"https://arxiv.org/pdf/2404.14720v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"links_only","authors_date_abstract":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license), from the Kaggle arXiv metadata snapshot of 2026-09-12"},"code_links":[{"paper_slug":"incorporating-gradients-to-rules-towards","repo_url":"https://github.com/lexuswang/captain","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"none","reach":{"status":"ok","spdx":"Apache-2.0"}}],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2404.14720","atlas_url":"https://app.syntology.ai/?focus=2404.14720","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2404.14720"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/lexuswang/captain","reach":{"status":"ok","spdx":"Apache-2.0"}}],"summary":{"ran":6},"by_repo_kind":{"official":{"samples":6,"ran":6,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"7d32ba6259cc23ac","entry":"check_node","repo":"lexuswang/captain","repo_kind":"official","path":"node-level-gt.py","file_url":"https://github.com/lexuswang/captain/blob/HEAD/node-level-gt.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"7d32ba6259cc23ac"}},{"code_sha256_prefix":"c7ad99a8fc6331f4","entry":"extract_benign_substructure","repo":"lexuswang/captain","repo_kind":"official","path":"adversarial/extract_benign_structrue.py","file_url":"https://github.com/lexuswang/captain/blob/HEAD/adversarial/extract_benign_structrue.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"c7ad99a8fc6331f4"}},{"code_sha256_prefix":"5931bd095a603941","entry":"get_network_feature_vector","repo":"lexuswang/captain","repo_kind":"official","path":"feature/NetFlowObjFeatures.py","file_url":"https://github.com/lexuswang/captain/blob/HEAD/feature/NetFlowObjFeatures.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"5931bd095a603941"}},{"code_sha256_prefix":"9cdd54cb086862b8","entry":"get_target","repo":"lexuswang/captain","repo_kind":"official","path":"model/target_label.py","file_url":"https://github.com/lexuswang/captain/blob/HEAD/model/target_label.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"9cdd54cb086862b8"}},{"code_sha256_prefix":"298b1b78a59cd040","entry":"ipaddr_to_list","repo":"lexuswang/captain","repo_kind":"official","path":"feature/NetFlowObjFeatures.py","file_url":"https://github.com/lexuswang/captain/blob/HEAD/feature/NetFlowObjFeatures.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"298b1b78a59cd040"}},{"code_sha256_prefix":"75352af881cc33e5","entry":"load_graph","repo":"lexuswang/captain","repo_kind":"official","path":"train_by_benign.py","file_url":"https://github.com/lexuswang/captain/blob/HEAD/train_by_benign.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"75352af881cc33e5"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}